SEC53-JG. Do not expose methods that use the immediate caller's class loader instance

Class loaders's allow an application to dynamically extend a Java application at runtime by loading classes.  For each class it loads, the JVM keeps track of which class loader loaded the class. When a loaded class first refers to another class, the virtual machine requests the referenced class from the same class loader that originally loaded the referencing class. 

Java's class loader architecture controls interaction between code loaded from different sources by using different class loaders to load code from different sources.  This prevents malicious code from gaining access to and subverting trusted code.  A class loader that loads untrusted code should not interact with trusted code that invokes any of the methods from the following table:

Certain standard APIs in the core libraries of the Java runtime enforce SecurityManager checks but allow those checks to be bypassed depending on the immediate caller's class loader. When the java.lang.Class.newInstance method is invoked on a Class object, for example, the immediate caller's class loader is compared to the Class object's class loader. If the caller's class loader is an ancestor of (or the same as) the Class object's class loader, the newInstance method bypasses a SecurityManager check. (See Section 4.3.2 in [1] for information on class loader relationships). Otherwise, the relevant SecurityManager check is enforced.

The difference between this class loader comparison and a SecurityManager check is noteworthy. A SecurityManager check investigates all callers in the current execution chain to ensure each has been granted the requisite security permission. (If AccessController.doPrivileged was invoked in the chain, all callers leading back to the caller of doPrivileged are checked.) In contrast, the class loader comparison only investigates the immediate caller's context (its class loader). This means any caller who invokes Class.newInstance and who has the capability to pass the class loader check--thereby bypassing the SecurityManager--effectively performs the invocation inside an implicit AccessController.doPrivileged action. Because of this subtlety, callers should ensure that they do not inadvertently invoke Class.newInstance on behalf of untrusted code.

        package yy.app;

        class AppClass {
           OtherClass appMethod() throws Exception {
               return OtherClass.class.newInstance();
           }
        }

        +--------------------------------+
        | xx.lib.LibClass                |
        |   .LibClass                    |
        +--------------------------------+
        | java.lang.Class                |
        |   .newInstance                 |
        +--------------------------------+
        | yy.app.AppClass |<-- AppClass.class.getClassLoader
        | .appMethod |       determines check
        +--------------------------------+

        |                                |

Code has full access to its own class loader and any class loader that is a descendent. In the case of Class.newInstance access to a class loader implies access to classes in restricted packages (e.g., sun.* in the Sun JDK).

In the diagram below, classes loaded by B have access to B and its descendents C, E, and F. Other class loaders, shown in grey strikeout font, are subject to security checks.

        +-------------------------+

        | bootstrap loader | <--- null
        +-------------------------+
         ^ ^
        +------------------+ +---+

        | extension loader | | A |
        +------------------+ +---+
         ^
        +------------------+

        | system loader | <--- Class.getSystemClassLoader()
        +------------------+
         ^ ^
        +----------+   +---+

        | B |   | F |
        +----------+   +---+
          ^      ^     ^

        +---+  +---+   +---+
        | C |  | E |   | G | 
        +---+  +---+   +---+
          ^
        +---+
        | D |
        +---+

The invocation of these methods is allowed by the trusted code's class loader, however, untrusted code's class loader may lack these privileges. When the untrusted code's class loader delegates to the trusted code's class loader, the untrusted code has visibility to the trusted code according to the declared visibility of the trusted code. In the absence of such a delegation relationship, the class loaders would ensure namespace separation; consequently, the untrusted code would be unable to observe members or to invoke methods belonging to the trusted code. Such a delegation model is imperative to many Java implementations and frameworks so the best advice is to avoid exposing these methods to untrusted code.

Consider, for example, an attack scenario where untrusted code is attempting to load a privileged class. Its class loader is permitted to delegate the class loading to the trusted class's class loader. This can result in privilege escalation, because the untrusted code's class loader may lack permission to load the requested privileged class. Further, if the trusted code accepts tainted inputs, the trusted code's class loader could load additional privileged — or even malicious — classes on behalf of the untrusted code.

Classes that have the same defining class loader exist in the same namespace but may have different privileges, depending on the security policy. Security vulnerabilities can also arise when trusted code coexists with untrusted code (or less privileged code) that was loaded by the same defining class loader. In this case, the untrusted code can freely access members of the trusted code according to their declared accessibility. When the trusted code uses any of the tabulated APIs, no security manager checks are carried out (with the exception of loadLibrary and load).

A security sensitive class loader typically employs the security manager to enforce a security policy. For example, the applet class loader ensures that an applet cannot directly invoke methods of classes present in the com.sun.* package. A security manager check ensures that specific actions are allowed or denied depending on the privileges of the caller methods on the call stack (the privileges are associated with the code source that encompasses the class). A security manager complements the security offered by the class loader architecture and does not supersede it. Consequently, APIs that perform security manager checks may still violate this guideline at the class loader level when exposed to untrusted callers.

With the exception of loadLibrary() and load() methods, the tabulated methods do not perform any security manager checks. Because the loadLibrary and load APIs are typically used from within a doPrivileged block, unprivileged callers can directly invoke them without requiring any special permissions. That means that the security manager checks are curtailed at the immediate caller and the entire call stack is not examined, resulting in no enhanced security. Accepting tainted inputs from untrusted code and allowing them to be used by these APIs may also expose vulnerabilities.

This guideline is an instance of SEC04-J. Protect sensitive operations with security manager checks. Many examples also violate SEC00-J. Do not allow privileged blocks to leak sensitive information across a trust boundary.

Noncompliant Code Example

In this noncompliant code example a call to System.loadLibrary() is embedded in a doPrivileged block. This is insecure because a library can be loaded on behalf of untrusted code. In essence, the untrusted code's class loader may be able to indirectly load a library even though it lacks sufficient permissions. After loading the library, untrusted code can call native methods on it if the methods are accessible. This is possible because the doPrivileged block stops security manager checks being applied to callers further up the execution chain.

public void load(String libName) {
  AccessController.doPrivileged(new PrivilegedAction() {
    public Object run() { 
      System.loadLibrary(libName);
      return null; 
    }
  });
}

Nonnative library code can also be susceptible to related security flaws. Loading a nonnative safe library may not directly expose a vulnerability, but after loading an additional unsafe library, an attacker can easily exploit the safe library if it contains other vulnerabilities. Moreover, nonnative libraries often use doPrivileged blocks, making them lucrative targets.

Compliant Solution

This compliant solution reduces the accessibility of method load() from public to private. Consequently, untrusted callers are prohibited from loading the awt library. Also, the name of the library is hard-coded to reject the possibility of tainted values.

private void load() {
  AccessController.doPrivileged(new PrivilegedAction() {
    public Object run() { 
      System.loadLibrary("awt");
      return null; 
    }
  });
}

Noncompliant Code Example

A method that passes untrusted inputs to the Class.forName() method might permit an attacker to access classes with escalated privileges. The single argument Class.forName() method is another API method that uses its immediate caller's class loader to load a requested class. Untrusted code can misuse this API to indirectly manufacture classes that have the same privileges as those of the attacker's immediate caller.

public Class loadClass(String className) {
  // className may be the name of a privileged or even a malicious class
  return Class.forName(className);
}

Compliant Solution (Hardcoded Name)

This compliant solution hard-codes the class's name.

public Class loadClass() {
  return Class.forName("Foo");
}

Noncompliant Code Example

This noncompliant code example returns an instance of java.sql.Connection from trusted to untrusted code. Untrusted code that lacks the permissions required to create a SQL connection can bypass these restrictions by using the acquired instance directly.

public Connection getConnection(String url, String username, String password) {
  // ...
  return DriverManager.getConnection(url, username, password);
}

Compliant Solution

The getConnection() method is unsafe because it uses the url to indicate a class to be loaded; this class serves as the database driver. This compliant solution prevents a malicious user from supplying their own URL to the database connection; thereby limiting their ability to load untrusted drivers.

private String url = // hardwired value

public Connection getConnection(String username, String password) {
  // ...
  return DriverManager.getConnection(this.url, username, password);
}

Applicability

Allowing untrusted code to carry out actions using the immediate caller's class loader may allow the untrusted code to execute with the same privileges as the immediate caller.

It is permissible to use APIs that do not use the immediate caller's class loader instance. For example, the three-argument java.lang.Class.forName() method requires an explicit argument that specifies the class loader instance to use. Do not use the immediate caller's class loader as the third argument if instances must be returned to untrusted code.

public static Class forName(String name, boolean initialize,  ClassLoader loader) /* explicitly specify the class loader to use */ throws ClassNotFoundException

Risk Assessment

Related Guidelines

Bibliography

[API 2011] Class ClassLoader